Vyankatesh Kudtarkar
aa6abd99f2
Support V2beta1 Version ( #4514 )
...
introduce new version V2beta1 which remove deprecated CRD
types from version v1.
Signed-off-by: Vyankatesh <vyankateshkd@gmail.com>
2022-09-08 11:19:16 +00:00
Charles-Edouard Brétéché
a95d61b9d7
refactor: client wrappers ( #4519 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-07 12:01:43 +08:00
Charles-Edouard Brétéché
f243a7dd84
refactor: make toggles easier to define and use ( #4456 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-08-31 06:41:14 +00:00
shuting
3bf3dcc1af
Add the metric "kyverno_client_queries_total" ( #4359 )
...
* Add metric "kyverno_kube_client_queries_total"
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* publish metric for missing queries
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Refactor the way Kyverno registers QPS metric
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Move clientsets to a dedicated folder
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Wrap Kyverno client and policyreport client to register client query metric
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* address linter comments
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* address linter comments
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Switch to use wrapper clients
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-08-31 11:33:47 +05:30
Riko Kudo
5f5cda9fee
Yaml signing and verification ( #4235 )
...
* enable YAML verification using k8s-manifest-sigstore
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
comment out role and rolebinding for dryrun
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update k8s-manifest-sigstore version
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix pubkey setting
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix pubkey setting
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix log message
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
change default value of dryrun option
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update crd
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
support gpg signature
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* upgrade manifest sigstore version and support multi sigs
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix validate.manifest rule
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update crd and add small fix
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix manifest verify policy
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
set cosign experimental env when keyless verification
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* improve default ignoreFields
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* fix manifest verify policy
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix manifest verify policy
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix manifest verify policy
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* add unit-test for k8smanifest
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update install yaml
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* update k8s-manifest-sigstore version and support one or more signatures
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
add unit-test for k8smanifest multi-signature
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix verifyManifest result message
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix verifyManifest result message
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* fix manifest verify policy and move dryrun rbac to dryrun dir
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* update k8s-manifest-sigstore version
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update k8s-manifest-sigstore version
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update k8s-manifest-sigstore version and resolve conflict
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
enable YAML verification using k8s-manifest-sigstore
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
comment out role and rolebinding for dryrun
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix pubkey setting
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix pubkey setting
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update crd
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
upgrade manifest sigstore version and support multi sigs
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix validate.manifest rule
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update crd and add small fix
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix manifest verify policy
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
update k8s-manifest-sigstore version and support one or more signatures
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix verifyManifest result message
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix verifyManifest result message
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
fix manifest verify policy and move dryrun rbac to dryrun dir
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
add small fix
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* remove generic name
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* fix sonatype-lift issue and unit-test error
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* fix gofumpt error
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
* update manifest rule to use attestor
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* remove unused value
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* resolve conflict
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix install.yaml
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix to set COSIGN_EXPERIMENTAL env variable when keyless verification
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix misspell
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* enable kyverno cli in validate.manifests rule (#3 )
* enable kyverno cli in validate.manifests rule
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* update k8s-manifest-sigstore version and improve error handling for better result output
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* update crds and deepcopy
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* update unit test
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* update k8s-manifest-sigstore version
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* change to use spec.rules.exclude.subjects instead of skipUsers (#4 )
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* update k8s-manifest-sigstore version
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix yaml signing sigstore (#5 )
* update k8s-manifest-sigstore version
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* add a comment for dryrun option field
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* enable to include ClusterPolicy/Policy in match resource
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix log style and env variable settings
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* simplify manifest verify func
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix func name
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix sonatype warning
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix default ignoreFields
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix yaml signing sigstore rbac (#6 )
* fix dryrun rbac to have minimal permissions
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix lint error
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix unit-test error
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix gofumpt error
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* fix log style
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* updated CRD documentation
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* resolve go.mod conflicts
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
* updated helm stuff
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-08-30 10:14:54 -07:00
Charles-Edouard Brétéché
144985ee5a
chore: fix golangcilint timeout ( #4388 )
...
* chore: fix golangcilint timeout
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix commit sha
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* add .gitattributes
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-08-24 21:08:24 +08:00
Anutosh Bhat
d92e16526f
Added appropriate logging levels to log.Info() calls wherever necessary ( #4341 )
...
* Added appropriate logging levels to log.Info() calls wherever necessary
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
* Changed logging levels to 2
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-08-18 13:24:59 +00:00
Vyankatesh Kudtarkar
de743ad2c9
Fix deprecated api policy issue ( #4349 )
2022-08-18 10:49:06 +05:30
Charles-Edouard Brétéché
421b490c56
feat: use tombstone helper ( #4273 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-08-03 16:17:07 +00:00
shuting
750b4b106c
Reset policy status on termination ( #4269 )
...
- reset policy status to false on termination
- retry reconciling policies when .status.ready=false
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-07-27 14:15:06 +05:30
Thomas Hartland
6e9609409b
Use non-blocking channel send for UpdateWebhookChan ( #4204 )
...
If the channel send is blocked then there is already an
update queued, and there is no point waiting to queue
another one.
In profiling, the channel send in monitor.go has been
seen to "leak" goroutines as the channel is not being
read from fast enough, but the root cause is not known.
Signed-off-by: Thomas Hartland <thomas.hartland@diamond.ac.uk>
2022-07-12 00:21:20 +08:00
Charles-Edouard Brétéché
210a709bb3
feat: policy status for autogen rules ( #4173 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-07-03 15:09:18 -07:00
Charles-Edouard Brétéché
41a3f6c388
chore: make kyverno informers and listers import aliases consistent ( #3958 )
...
* chore: make kyverno api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make apimachinery api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make dclient api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make clients import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make kube informers and listers import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make kyverno informers and listers import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-05-18 04:02:31 +00:00
Charles-Edouard Brétéché
572a76ce33
chore: make kube informers and listers import aliases consistent ( #3957 )
...
* chore: make kyverno api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make apimachinery api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make dclient api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make clients import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make kube informers and listers import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 17:51:03 +02:00
Charles-Edouard Brétéché
5243763674
chore: make dclient import aliases consistent ( #3951 )
...
* chore: make kyverno api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make apimachinery api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make dclient api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 14:40:51 +00:00
Charles-Edouard Brétéché
666bcb3c15
chore: make k8s api import aliases consistent ( #3950 )
...
* chore: make kyverno api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make apimachinery api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 22:14:31 +08:00
Charles-Edouard Brétéché
5aaf2d8770
chore: make kyverno api import aliases consistent ( #3939 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 13:12:43 +02:00
Charles-Edouard Brétéché
0099ef54ad
chore: enable gofmt and gofumpt linters ( #3931 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 06:19:03 +00:00
Charles-Edouard Brétéché
97cf1b3e95
feat: gracefull certificates rotation support ( #3890 )
...
* refactor: remove deployment hash on certs secrets
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: add label on kyverno webhooks
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: implement update ca bundle
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* test: set very low validity and expiration intervals
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: writing secret
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* add renew ca
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* decouple ca and tls validity duration
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactored code, everything is in place to finalize implementation
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* use real validity periods
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-12 14:07:25 +00:00
Charles-Edouard Brétéché
8f825bb040
refactor: remove deployment hash on certs secrets ( #3886 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-11 16:58:14 +02:00
Charles-Edouard Brétéché
2064a69b8a
refactor: make config vars private ( #3823 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-11 06:14:30 +00:00
Charles-Edouard Brétéché
97e5e64fd4
chore: enable whitespace linter ( #3864 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-10 17:01:29 +00:00
Charles-Edouard Brétéché
22e85209c4
fix: remove code to load CA from kubeconfig ( #3860 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-10 16:12:22 +00:00
Jim Bugwadia
bc07943c81
handle subresources ( #3841 )
...
* handle subresources
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix logger name
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix webhook and logs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-05-09 18:50:50 -07:00
Charles-Edouard Brétéché
ba4413b25c
refactor: webhookconfig package (part 4) ( #3835 )
2022-05-09 16:54:20 +01:00
Charles-Edouard Brétéché
27e7b2d326
refactor: webhookconfig package (part 3) ( #3834 )
...
* refactor: webhookconfig package (part 1)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: webhook config package (part 2)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: webhookconfig package (part 3)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-09 14:31:35 +00:00
Charles-Edouard Brétéché
bbe65959bc
refactor: webhook config package (part 2) ( #3833 )
...
* refactor: webhookconfig package (part 1)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: webhook config package (part 2)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-08 14:14:31 +02:00
Charles-Edouard Brétéché
af56adb0a6
refactor: webhookconfig package (part 1) ( #3831 )
...
* refactor: webhookconfig package (part 1)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: sonatype issue
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-08 12:47:49 +01:00
Charles-Edouard Brétéché
306b22a5db
fix: policy deletion in webhookconfig ( #3832 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-07 21:09:19 +01:00
Charles-Edouard Brétéché
5d2e2faf72
fix: autogen rules in status ( #3728 )
...
* refactor: autogen package logger
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: add rules to status only when necessary
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-05-05 15:11:26 +00:00
Charles-Edouard Brétéché
bb6e9a1ada
refactor: move config controller in controllers package ( #3790 )
...
* refactor: use typed informers and add tombstone support to webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: remove unstructured usage from webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: cert manager controller
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: move config controller in controllers package
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-04 16:05:03 +00:00
Charles-Edouard Brétéché
db735f2165
fix: pod stay in terminating when scaling to 0 ( #3793 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-04 10:57:56 +00:00
Charles-Edouard Brétéché
400e486b46
refactor: create a package for controllers and move certmanager in it ( #3782 )
...
* refactor: use typed informers and add tombstone support to webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: remove unstructured usage from webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: cert manager controller
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-04 00:23:34 +08:00
Charles-Edouard Brétéché
873e394e5f
fix: cert manager duplicate event handler ( #3772 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-03 07:37:18 +00:00
Danny Kulchinsky
810369d876
webhookconfig: if services resource, add services/status as well ( #3740 )
...
Signed-off-by: Danny Kulchinsky <dkulchinsky@fastly.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-05-03 05:54:08 +00:00
Charles-Edouard Brétéché
c79223393b
refactor: dclient package ( #3775 )
...
* refactor: replace clientset by inteface
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: dclient package
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-03 13:30:04 +08:00
Charles-Edouard Brétéché
6e07acdd87
refactor: replace clientset by inteface ( #3774 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-02 20:30:07 +00:00
Charles-Edouard Brétéché
18af55ed49
refactor: wait for cache sync ( #3765 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-03 01:41:39 +08:00
Charles-Edouard Brétéché
972be16ad3
refactor: remove unstructured usage from webhookconfig ( #3737 )
...
* refactor: use typed informers and add tombstone support to webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: remove unstructured usage from webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-02 18:58:04 +08:00
Charles-Edouard Brétéché
87880ad6f1
refactor: use typed informers and add tombstone support to webhookconfig ( #3736 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-02 08:19:39 +00:00
Jim Bugwadia
ef71102b22
Fix verify all images ( #3748 )
...
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-01 23:02:49 +00:00
shuting
a4815f77c4
Convert GenerateRequest to UpdateRequest for backward compatibility ( #3730 )
...
- Remove GenerateRequest Informer
- Rename GenerateRequest to UpdateRequest in logs and vars
- Fix initContainer leader election
- Convert GenerateRequest to UpdateRequest in initContainer
- Remove unused methods
- Add printer column ruleType to UR
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-04-29 16:35:49 +05:30
Charles-Edouard Brétéché
de84b8071d
refactor: autogen package logger ( #3727 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-29 09:12:21 +00:00
Charles-Edouard Brétéché
7fca026678
fix: remove supported from autogen status ( #3714 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-28 16:14:48 -07:00
Jim Bugwadia
ab5171cee5
Verify digest ( #3679 )
...
* add verifyDigest to check all tags are converted to digests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add required to check for image verification annotation
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* generate CRD
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* adding imageverify true/false patch
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* patch addition logic
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* image verify CLI tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fixes and unit tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix digest mutate
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make codegen
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix policy cache
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: anushkamittal20 <anumittal4641@gmail.com>
2022-04-27 15:09:52 +00:00
Charles-Edouard Brétéché
a6924a11ab
refactor: use typed k8s client in tls package ( #3678 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-26 20:18:14 +00:00
Ioannis Bouloumpasis
a205bc3e2e
fix: webhooks are not configured correctly ( #3660 )
...
* Fix webhook rules equality when internal is empty
The current implementation of the 'webhookRulesEqual' didn't check for
the corner case were both the internal representation and the API have
length of one, but the internal representation has 1 rule with no
selectors.
In this case the 'webhookRulesEqual' should return false, as the 2
configurations are not the same.
Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>
* Fix tests
Add a small time delay when checking if a Policy is ready in tests to
ensure that the Policy is actually ready.
Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>
2022-04-25 15:19:39 +00:00
shuting
2a656f6de0
feat: mutate existing resources ( #3669 )
...
* feat: mutate existing, replace GR by UR in webhook server (#3601 )
* add attributes for post mutation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add UR informer to webhook server
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - replace gr with ur in the webhook server; - create ur for mutateExsiting policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* replace gr by ur across entire packages
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add YAMLs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update api docs & fix unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add UR deletion handler
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add api docs for v1beta1
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix clientset method
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix v1beta1 client registration
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: mutate existing - generates UR for admission requests (#3623 )
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* replace with UR in policy controller generate rules (#3635 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* - enable mutate engine to process mutateExisting rules; - add unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* implemented ur background reconciliation for mutateExisting policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix webhook update error
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* temporary comment out new unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: mutate existing, replace GR by UR in webhook server (#3601 )
* add attributes for post mutation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add UR informer to webhook server
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - replace gr with ur in the webhook server; - create ur for mutateExsiting policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* replace gr by ur across entire packages
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix missing policy.kyverno.io/policy-name label (#3599 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* refactor cli code from pkg to cmd (#3591 )
* refactor cli code from pkg to cmd
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixes in imports
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixes tests
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixed conflicts
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* moved non-commands to utils
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
* add YAMLs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update api docs & fix unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add UR deletion handler
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add api docs for v1beta1
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix clientset method
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add-kms-libraries for cosign (#3603 )
* add-kms-libraries
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* Shifted providers to cosign package
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Add support for custom image extractors (#3596 )
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
* Update vulnerable dependencies (#3577 )
Signed-off-by: Shubham Gupta <shubham.gupta2956@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix v1beta1 client registration
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: mutate existing - generates UR for admission requests (#3623 )
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* updating version in Chart.yaml (#3618 )
* updatimg version in Chart.yaml
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
* changes from, make gen-helm
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Allow kyverno-policies to have preconditions defined (#3606 )
* Allow kyverno-policies to have preconditions defined
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Fix docs
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* replace with UR in policy controller generate rules (#3635 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - enable mutate engine to process mutateExisting rules; - add unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* implemented ur background reconciliation for mutateExisting policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix webhook update error
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* temporary comment out new unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Image verify attestors (#3614 )
* fix logs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix logs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* support multiple attestors
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* rm CLI tests (not currently supported)
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* apply attestor repo
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix linter issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix entryError assignment
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add intermediary certs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* Allow defining imagePullSecrets (#3633 )
* Allow defining imagePullSecrets
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Use dict for imagePullSecrets
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Simplify how imagePullSecrets is defined
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Fix race condition in pCache (#3632 )
* fix race condition in pCache
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* refact: remove unused Run function from generate (#3638 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* Remove helm mode setting (#3628 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* refactor: image utils (#3630 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* -resolve lift comments; -fix informer sync issue
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* refact the update request cleanup controller
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* - fix delete request for mutateExisting; - fix context variable substitution; - improve logging
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - enable events; - add last applied annotation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* enable mutate existing on policy creation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update autogen code
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* merge main
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* address list comments
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update api docs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix "Implicit memory aliasing in for loop"
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* remove unused definitions
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update api docs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Co-authored-by: Mritunjay Kumar Sharma <mritunjaysharma394@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Anushka Mittal <55237170+anushkamittal20@users.noreply.github.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
Co-authored-by: Shubham Gupta <shubham.gupta2956@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Prateek Nandle <56027872+Prateeknandle@users.noreply.github.com>
Co-authored-by: treydock <tdockendorf@osc.edu>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-25 12:20:40 +00:00
Ioannis Bouloumpasis
78a6f20572
fix: do not remove webhooks during initialization ( #3641 )
...
* Do not remove webhooks during initialization
During initialization the Kyverno leader Pod deletes all the
existing webhooks and recreates them. There is a small time window were
the cluster is not protected by the webhooks, allowing a user to apply
resources without any verfication.
This commit updates the leader registration logic to not remove and
recreate the webhooks but, in the case that the webhooks already exist,
update them.
Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>
* Fix linter errors
Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>
* Use the Lister to get webhook configurations
Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>
2022-04-22 14:50:29 +08:00
Charles-Edouard Brétéché
594a04db01
refactor: simplify autogen package ( #3532 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-04-05 15:12:22 +00:00
